ATLAS AML.T0129: Triggers in Multimodal Inputs

If your guardrails read the text of a request but the model also reads its image, audio, video and file metadata, an attacker only has to put the payload where your controls are not looking. MITRE ATLAS records this as AML.T0129 Triggers in Multimodal Inputs, a Defense Evasion (AML.TA0007) technique added in September 2026 for the Generative AI and Agentic AI platforms, with maturity rated Feasible. The technique is not a new kind of injection: it is the choice of carrier that slips past inspection that covers text only. This guide is about that inspection gap: how to map which modalities and metadata fields each control actually sees, how to close the gaps with the two mitigations ATLAS maps (AML.M0008 and AML.M0020), and how to test and measure coverage. It is for AI platform teams, application security engineers and red teams. The carriers themselves, and the wider control set, are covered in the Multimodal Prompt Injection Guide; this page does not repeat them.

Key takeaways

The technique is about evasion, not delivery. ATLAS places AML.T0129 under Defense Evasion: the payload is still parsed by the model, but sits in a modality that moderation does not inspect, or inspects differently from text.
Metadata is a named carrier. ATLAS lists EXIF in images, ID3 tags in audio and document metadata alongside the image, audio and video channels themselves.
Two mitigations are mapped. AML.M0020 Generative AI Guardrails (inspect every supported modality and its metadata before ingestion) and AML.M0008 Validate AI Model (evaluate each modality alone and in combination for hidden triggers).
Coverage is measurable. Build a matrix of modality and metadata field against each control, and test every cell. An empty cell is the attack surface this technique describes.
Assume some triggers get through. Published research shows payloads that survive or are created by preprocessing, so the decisive control remains limiting what the model can do after it reads media.

What ATLAS describes

The ATLAS entry (release 2026.10) says adversaries may place instructions or triggers in one part of a multimodal input so that they influence the model while staying unnoticed by human reviewers and by defences that do not inspect all input modalities. It explains why this works: multimodal systems process text jointly with other modalities, yet many moderation and filtering controls operate mainly on the text channel. A payload in a modality that is not inspected is still parsed by the model, and can change model output or carry a cross-modal prompt injection.

Two words in the definition matter for defenders:

Instructions: natural language directives the model follows, which makes AML.T0129 a delivery route for AML.T0051 LLM Prompt Injection, usually the indirect sub-technique AML.T0051.001 when the media comes from a third party.
Triggers: inputs that activate behaviour already present in the model, for example a backdoor planted by poisoning. Here the multimodal input does not need to contain readable instructions at all; it only needs to contain the pattern the model was trained to react to. The planting itself is a separate technique (see AML.T0020 Training Data Poisoning).

AML.T0129 sits next to AML.T0068 LLM Prompt Obfuscation, which covers how instructions are disguised (tiny or low-contrast text in images, faint or sped-up speech, single video frames, encodings). T0068 is about making the payload hard to see; T0129 is about placing it in a channel that is not checked. A single attack often uses both. ATLAS gives AML.T0129 no ATT&CK equivalent; the closest enterprise technique for the outcome is MITRE ATT&CK T1698 Indirect Prompt Injection.

Evidence from published research

ATLAS links no case study to AML.T0129 in release 2026.10. The research below shows the gap is real; each item is described at the depth defenders need, without reproducing methods.

Research	Modality	What it shows for defenders
Bagdasaryan, Hsieh, Nassi and Shmatikov, "Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs" (arXiv 2307.10490, 2023)	Image and audio	An adversarial perturbation blended into an image or recording steered an unmodified model (LLaVA and PandaGPT in the proof of concept) to attacker-chosen output, or made the rest of the conversation follow attacker instructions. There may be no extractable text for any filter to read.
Gong et al., "FigStep" (arXiv 2311.05608)	Image (typography)	Rendering prohibited requests as images instead of text bypassed safety alignment with an average success rate of 82.50% across six open-source vision-language models. The authors attribute it to a gap in safety alignment for visual inputs and call for cross-modality alignment.
Trail of Bits, "Weaponizing image scaling against production AI systems" (August 2025)	Image (preprocessing)	Images that look harmless at full size reveal injected text only after the application downscales them. Demonstrated against several production systems, including data exfiltration through Gemini CLI with an MCP server configured to auto-approve tool calls. The interface showed the full-resolution image while the model saw the downscaled one.

The common lesson: the object a human reviews, the object a filter scans and the object the model receives can be three different things. AML.T0129 exploits any difference between them.

Map your inspection coverage

Start by writing down, for each AI application, every modality and metadata field the model can receive, and which control inspects each one. A simple coverage matrix makes the gaps visible.

Input element	Does the model receive it?	Typical inspection gap	What closes it
Prompt text	Yes	Usually inspected; the baseline	Existing text guardrail
Text rendered inside images	Yes, via the vision encoder	Text guardrail never sees it	OCR the exact model-bound image and pass the result through the same guardrail, or a guardrail that accepts images
Image after resize, crop or compression	Yes, this is what the model sees	Inspection runs on the original upload	Inspect after preprocessing, on the final tensor-bound image
Speech and audio	Yes, natively or via transcription	Transcript inspected, native audio path not inspected	Inspect the transcript the model actually uses; avoid feeding raw audio and transcript by different routes
Video frames	Sampled frames	Inspection samples different frames from the model	Inspect the same frame set the model receives
Image metadata (EXIF, XMP, PNG text chunks)	Only if the pipeline passes it	Passed into context without inspection	Strip by default; if needed, extract named fields and treat them as untrusted text
Audio metadata (ID3 tags)	Only if the pipeline passes it	Same as above	Strip or allowlist fields
Document metadata and hidden content (properties, comments, annotations, hidden text layers)	Often, through document parsers	Parser output reaches the model unfiltered	Normalise to visible content; inspect parser output, not the file

The key design rule: inspect the object at the last point before inference, after every transformation. A control placed before preprocessing is inspecting a different object.

Mitigations ATLAS maps

AML.M0020 Generative AI Guardrails

For this technique ATLAS describes the guardrail as inspecting supported image, audio, video, text and metadata inputs for concealed instructions or triggers before model ingestion. In practice:

Reduce the surface first. Accept only the modalities and file types the use case needs. Enforce maximum dimensions, durations and file sizes. Trail of Bits recommends avoiding downscaling where possible and limiting upload dimensions.
Normalise. Re-encode media to a canonical format, strip metadata by default, and flatten documents to their visible content.
Extract and inspect. Run OCR on images and frames and use the transcript for audio, then pass the derived text through the same injection classifier and policy as typed text. Tag derived text with the trust level of the file, not of the user who uploaded it.
Check consistency. Flag inputs where derived text is present but the user's request did not refer to any text, or where text appears only after preprocessing.
Show what the model sees. Where downscaling is unavoidable, Trail of Bits recommends previewing the exact model input to the user, including in command line and API tools.

Guardrail capabilities and limitations are covered in the AI Guardrails and AI Firewalls Guide. Adversarial perturbations (the Bagdasaryan research) may yield no extractable text, so extraction-based inspection will not catch them; that is why the next two controls matter.

AML.M0008 Validate AI Model

ATLAS asks for models to be evaluated across supported input modalities, individually and in combination, for hidden instructions or triggers that alter behaviour. More broadly, M0008 calls for evaluation before deployment and again after fine-tuning, model updates or changes in how the model is used, including tests for backdoor triggers. For a multimodal deployment that means:

Per-modality test suites: the same policy test cases expressed as text, as rendered text in images, as speech and in metadata, so a refusal in one channel is checked in every other channel.
Cross-modal cases: benign text with a hostile image, and the reverse, as OWASP LLM01:2025 Scenario 7 describes.
Re-test on change: a new vision encoder, a model version upgrade or a change in the preprocessing library (resampling behaviour differs between libraries) invalidates earlier results.
Provenance for weights: for backdoor triggers, validation is backed by controls on where the model and its fine-tuning data came from.

Limit the blast radius

Neither mitigation catches everything. Trail of Bits' final recommendation is a secure design in which text found inside inputs, including inside images, cannot trigger sensitive tool calls without explicit user confirmation. Remove auto-approval for tools in any agent that reads untrusted media, and keep the agent's credentials scoped to the task. The outcomes to block are the ones ATLAS lists elsewhere: AML.T0053 AI Agent Tool Invocation, MITRE ATLAS AML.T0086 Exfiltration via AI Agent Tool Invocation and MITRE ATLAS AML.T0077 LLM Response Rendering.

Where identity fits

A multimodal trigger does damage through the identity the model acts as. The Trail of Bits exfiltration worked because the agent held a connector credential and the MCP server was set to auto-approve calls. Give agents that process uploads or browse the web their own non-human identity, scope its tokens to the minimum tool set, require approval for any write or outbound transfer, and log every tool call against that identity. See the Agent Identity and Access Guide.

Detection and measurement

Log enough to reconstruct what the model received: a hash of the original upload, a hash of the preprocessed input, derived text (OCR or transcript), metadata fields passed into context, guardrail verdicts per modality, and tool calls that followed. Signals worth alerting on:

Derived text containing imperative instructions, references to tools, URLs or system prompts, when the user's request was not about the media's text.
Large differences between OCR results on the original and on the downscaled image.
Non-empty metadata fields reaching the context window in a pipeline that is meant to strip them.
A tool call or outbound URL within the same turn as a media upload from an external source.

Metric	What it shows	Target direction
Coverage matrix completeness: share of modality and metadata cells with a tested control	Whether the gap AML.T0129 exploits still exists	100% for every production application
Cross-modal test pass rate: share of policy cases blocked in every modality, not just text	Consistency of guardrails across channels	Equal to the text-only pass rate
Inspection point compliance: share of pipelines that inspect after the last preprocessing step	Whether controls see what the model sees	100%
Agents reading untrusted media with auto-approved tools	Blast radius if a trigger gets through	Zero
Time since last multimodal re-validation after a model or preprocessing change	Whether M0008 results are current	Re-tested before each release

How to test

Scope and authorise. Test only systems you own, under an agreed plan (see the AI Red Team Test Plan Template).
Use benign canaries. Instead of harmful payloads, place a harmless marker instruction (for example, asking the model to include a specific code word) in each cell of the coverage matrix: rendered image text, post-resize image, audio, video frame, each metadata field, each document hidden layer.
Observe two things per cell. Did the guardrail flag it, and did the model act on it? A cell where the model acts but the guardrail is silent is an AML.T0129 gap.
Repeat with tools connected in a sandbox with dummy credentials, confirming that any tool call triggered from media requires approval.
Re-run on every change to model version, encoder, preprocessing library or upload limits, and keep the results as M0008 evidence.

Common failure patterns

Guardrail on the prompt only. The text filter is tested and tuned, while images and attachments go straight to the model, the gap FigStep demonstrated against safety alignment.
Inspecting the upload, not the input. Scanning happens before resizing, so text revealed by downscaling is never seen.
Metadata passed through by default. Parsers hand EXIF descriptions, ID3 comments or document properties to the context window because nobody chose to drop them.
Derived text trusted as user text. OCR output and transcripts inherit the uploader's trust instead of the file's.
Auto-approved tools in media-reading agents. The decisive factor in the Trail of Bits exfiltration demonstration.
Validation done once. A model or library upgrade changes how inputs are interpreted, but the multimodal test suite is not re-run.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS	AML.T0129 Triggers in Multimodal Inputs (AML.TA0007 Defense Evasion)	This technique
MITRE ATLAS	AML.M0020 Generative AI Guardrails; AML.M0008 Validate AI Model	Mapped mitigations
MITRE ATLAS	AML.T0051.001 Indirect; AML.T0068 LLM Prompt Obfuscation; AML.T0018 Manipulate AI Model	What the trigger carries or activates, and how it is disguised
OWASP Top 10 for LLM Applications 2025	LLM01:2025 Prompt Injection, Scenario 7 Multimodal Injection	Names hidden instructions in images accompanying benign text
MITRE ATT&CK v20	T1698 Indirect Prompt Injection	Closest enterprise technique for the outcome; no direct ATLAS mirror
NIST AI 100-2 E2025	Adversarial Machine Learning taxonomy	Shared vocabulary for evasion, poisoning and prompt injection

Practitioner checklist

List every modality and metadata field each AI application passes to its model.
Build the coverage matrix and assign an owner to every empty cell.
Move inspection to the last step before inference, after resizing, transcription and parsing.
Strip media and document metadata by default; allowlist any field the use case needs.
Run OCR and transcripts through the same guardrail as typed text, tagged with the file's trust level.
Limit accepted file types, dimensions and durations; preview the model-bound image where it is downscaled.
Turn off tool auto-approval for agents that read untrusted media; require confirmation for writes and outbound transfers.
Maintain per-modality and cross-modal validation suites and re-run them on every model or preprocessing change.

AML.T0129 Triggers in Multimodal Inputs: Detecting Hidden Triggers in Images, Audio and Documents